Initial server source import

2026-09-30 20:30:56 +03:00
commit 170dd941b9
498 changed files with 261563 additions and 0 deletions
@@ -0,0 +1,79 @@
+# Worker Cheatsheet Validation - 2026-09-30
+
+## Scope
+
+Validation used isolated fake device tokens, private local state roots, a local
+TLS no-work fixture, unique Docker names/volumes, and fresh artifacts. It did not
+contact production, issue assignments, or use production credentials.
+
+## Initial audit
+
+- Windows package exposed install, start, stop, status, attach, logs, history,
+  and doctor; `watch` was rejected as an invalid command.
+- The Linux image exposed the same command set, but an assembled native Linux
+  package had no package-root launcher or preparation workflow.
+- First installation required token-bearing process arguments. Later lifecycle
+  commands already read the private installed JSON configuration.
+- Active quickstart and operations instructions recommended server cap zero for
+  routine local maintenance.
+- An unreachable-server negative check made `stop --timeout 120` return a
+  non-drained receipt with exit code 2 instead of reporting false success.
+
+## Fresh artifact identities
+
+| Artifact | Identity |
+| --- | --- |
+| Final Windows ZIP SHA-256 | `210eb61e8d6c35b014b39b18b4dd7e28e1e057a11d57790188f7904487bac004` |
+| Windows package manifest | `4572e349cead890c4efdc113e4d41285981086db7c0783fb67493fdeb6bac04c` |
+| Linux/Docker image | `sha256:8bc99d9e7e5f5f364de9b7d2b30100942b5ce3d9170a64e5abf0068ffc3d02c4` |
+| Linux package manifest | `19907f29382bd2b5a1de13fd53a829e97a5626fbacbed8f4286071ba4d5a9bec` |
+
+The final Windows ZIP was rebuilt after the last documentation correction. Its
+full lifecycle run used the same package-manifest identity; the rebuild changed
+only packaged operator-document bytes outside worker code authority.
+
+## Checked command matrix
+
+| Environment | YAML install | Doctor | Start | Status | Attach | Watch | Stop |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| Windows package | pass | pass | pass | pass | pass | pass | `drained=true`, `exit_code=0` |
+| Native Linux package under `/opt` | pass | pass | pass | pass | pass | pass | `drained=true`, `exit_code=0` |
+| Docker image with persistent volume | stdin pass | pass | pass | pass | pass | pass | `drained=true`, `exit_code=0` |
+
+The stopped Docker container reported `status=exited`, `exit=0`, and
+`oom=false`. `attach` and `watch` detached without stopping the verified worker
+on every environment.
+
+## Documentation result
+
+The active general guide and operations runbook contain no cap-zero routine and
+no token-bearing install command. Separate Windows, native Linux, and Docker
+cheatsheets contain copy-paste install, start, stop, attach, status, and watch
+commands. Historical dated validation reports retain factual records of earlier
+cap-zero experiments and are not active instructions.
+
+## Final gates
+
+- Focused worker/package/documentation matrix: `157 passed, 3 skipped`.
+- Windows packaged `watch --help`: pass.
+- Linux image launcher, preparation script, packaged cheatsheets, and shell
+  syntax smoke: pass.
+- Worker Compose rendering: pass.
+- Python compilation: pass.
+- Strict OpenSpec validation: pass.
+
+## Release build
+
+The final `dist/release-20260930-linux` release includes both native Linux and
+Docker Linux artifacts plus all platform sheets under `cheatsheets/`. All
+entries in `SHA256SUMS.txt` passed verification. The Docker bundle also contains
+the sheets and both `workerctl` helpers, and all eight internal checksums passed.
+The native archive contained no absolute paths, parent traversal, or links; its
+launchers retained mode 0755 and passed an extracted `/opt` preparation and CLI
+smoke test.
+
+| Release artifact | SHA-256 |
+| --- | --- |
+| Native Linux package | `e44717c9e84fc73d1d0734189da5b809c1c2271648868c05caea954bf46f6ebc` |
+| Docker Linux image archive | `80a59f180e7c1e4e5861427d94b44605a54ba08ed12198c63c3ae98c35678f63` |
+| Trusted Linux package manifest | `a3e8b73855d3b0854c5891cb5a10ff892aa0929e24046d2ce6fd28a245317e82` |